EP0762335B1 - Procédé pour changer les données chargées dans des cellules de stockage d'une machine d'affranchissement - Google Patents

Procédé pour changer les données chargées dans des cellules de stockage d'une machine d'affranchissement Download PDF

Info

Publication number
EP0762335B1
EP0762335B1 EP96250187A EP96250187A EP0762335B1 EP 0762335 B1 EP0762335 B1 EP 0762335B1 EP 96250187 A EP96250187 A EP 96250187A EP 96250187 A EP96250187 A EP 96250187A EP 0762335 B1 EP0762335 B1 EP 0762335B1
Authority
EP
European Patent Office
Prior art keywords
franking machine
program
mac
data
memory
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP96250187A
Other languages
German (de)
English (en)
Other versions
EP0762335A2 (fr
EP0762335A3 (fr
Inventor
Joachim Pilz
Olav A. Zarges
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Francotyp Postalia GmbH
Original Assignee
Francotyp Postalia GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Francotyp Postalia GmbH filed Critical Francotyp Postalia GmbH
Publication of EP0762335A2 publication Critical patent/EP0762335A2/fr
Publication of EP0762335A3 publication Critical patent/EP0762335A3/fr
Application granted granted Critical
Publication of EP0762335B1 publication Critical patent/EP0762335B1/fr
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
    • G07B17/00314—Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/08—Payment architectures
    • G06Q20/10—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • G06Q20/105—Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems involving programming of a portable memory device, e.g. IC cards, "electronic purses"
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/02—Marketing; Price estimation or determination; Fundraising
    • G06Q30/0283—Price estimation or determination
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
    • G07B17/0008—Communication details outside or between apparatus
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00016—Relations between apparatus, e.g. franking machine at customer or apparatus at post office, in a franking system
    • G07B17/0008—Communication details outside or between apparatus
    • G07B2017/00153—Communication details outside or between apparatus for sending information
    • G07B2017/00177—Communication details outside or between apparatus for sending information from a portable device, e.g. a card or a PCMCIA
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
    • G07B17/00193—Constructional details of apparatus in a franking system
    • G07B2017/00258—Electronic hardware aspects, e.g. type of circuits used
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
    • G07B17/00314—Communication within apparatus, personal computer [PC] system, or server, e.g. between printhead and central unit in a franking machine
    • G07B2017/00354—Setting of date
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00185—Details internally of apparatus in a franking system, e.g. franking machine at customer or apparatus at post office
    • G07B17/00362—Calculation or computing within apparatus, e.g. calculation of postage value
    • G07B2017/00395—Memory organization
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00459—Details relating to mailpieces in a franking system
    • G07B17/00508—Printing or attaching on mailpieces
    • G07B2017/00516—Details of printing apparatus
    • G07B2017/00524—Printheads
    • G07B2017/0054—Thermal printhead
    • G—PHYSICS
    • G07—CHECKING-DEVICES
    • G07B—TICKET-ISSUING APPARATUS; FARE-REGISTERING APPARATUS; FRANKING APPARATUS
    • G07B17/00—Franking apparatus
    • G07B17/00733—Cryptography or similar special procedures in a franking system
    • G07B2017/00741—Cryptography or similar special procedures in a franking system using specific cryptographic algorithms or functions
    • G07B2017/00774—MAC (Message Authentication Code), e.g. DES-MAC

Definitions

  • the invention relates to a method for changing the in memory cells loaded data of an electronic franking machine, according to that in the preamble of claim 1. This method improves the accessibility to individual components of the electronics without compromising their safety.
  • variable information is stored in memory means (ROM, RAM). If a letter is on the transport path before the print position Activated microswitch, this information is transmitted by means of a Microprocessor read out to form a pressure control signal. Both are then electronically assembled into a print image and can be franked on by thermal transfer printing medium Envelope can be printed out.
  • Known franking machines contain in at least one memory three relevant postal registers for total value used (increasing Register), remaining credit balance (falling register) and Register for a checksum.
  • the checksum is the sum from the total value used and from available credit compared. This is a check for correct billing possible.
  • the franking machine is stopped during remote inspection via modem by one of the data center outgoing signal blocked.
  • a clever manipulation could on the other hand, after the production of non-billed Franking imprints, the flag and the registers in the to restore the original state. Such manipulation would not be recognizable via remote inspection by the data center if this undone manipulation was prior to the remote inspection. Also the receipt of the postcard from the data center, on which one franking to be carried out for inspection purposes, allows the manipulator the franking machine in sufficient time to restore the original state. So that's not yet higher security achievable.
  • EP 660 269 a franking machine is still assumed which has a lockable and sealed flap that gives access to the the underlying hardware (EPROM socket) is limited specially trusted people allowed. Here could of it can be assumed that no manipulation of the Postage meter takes place.
  • This base is with the Microprocessor bus connected, which means that manipulation could occur done that a manipulator manipulated a program EPROM that uses control of the microprocessor system like a RESET EPROM takes over and thus monetary values, entries or security entries specifically changed in the franking machine or that a manipulated cliché EPROM uses that changed print data of the Value stamp contains (sender's place, sender's zip code) and would result in manipulation of the value stamp.
  • the interpreter routine is done once in the existing system and that executed second time after the program part of the dealer functions. Accordingly, the data / program areas related to this Purpose to be read from the external storage medium as a prologue and epilogue.
  • a MAC checksum takes place in the internal data area of the internal OTP-RAM in the next step by (DES) encryption of a (CRC) checksum over the PROLOG or EPILOG code area is formed and in the following test step a MAC comparison with the the production or programming of the special EPROM and the MAC checksum stored in the special EPROM via the PROLOG or EPILOG code area is carried out, and that after Steps to carry out the plausibility check Interpreter routine a further verification step is provided, the Errors or cases that occur during the execution of a program, that lead to the end of the interpretation process, or branched back to the further checking step for further commands work off.
  • the invention is preferably based on a processor that only can be programmed once (ONE TIME PROGRAMMABLE).
  • ONE TIME PROGRAMMABLE ONE TIME PROGRAMMABLE
  • a franking machine Microprocessor in which the microprocessor has an internal ROM contains that does not read the program code contained therein allowed.
  • a commercially available OTP processor ONE TIME PROGRAMMABLE that you can go through after the programming process set / burn a readout lock in such a state.
  • the franking machine can also be equipped with an OTP type readout of safety-relevant data and Programs in encrypted form permitted (encryption table).
  • the invention is also for otherwise secured microprocessor systems used.
  • the invention has the advantage of the program flow through the internal Operating software of the franking machine is specified by external storage media to influence, for this purpose no program branch the CPU into the memory areas of the external Storage medium, and thus no unwanted control of the processor is made possible. So in the program flow through external media Protect integrable program sequences from manipulation The prologue and epilogue are each secured by a MAC.
  • the opened service flap allows using a special EPROM to create a data structure from the outside via the external EPROM socket, which, for example, after actuation of a sealed mail flap covered and thus protected default button under the action of an internal interpreter to change the Postage meter condition contributes.
  • the interpreter will function as a special routine that is used in the internal program memory is saved by a Data structure created externally via the external EPROM socket is activated, and with the in the franking machine internal program memory interacts stored operating program parts to Interpret data.
  • a Data structure created externally via the external EPROM socket is activated, and with the in the franking machine internal program memory interacts stored operating program parts to Interpret data.
  • the aforementioned Data structure includes information processed by the interpreter and the aforementioned processor performs operations that only in the code area of the operating program in program memory internal to the franking machine.
  • interpreter routines can also be used in dealer mode To run. It is envisaged that several in the external storage medium Areas are provided which contain code to be interpreted, the individual areas are secured by MAC. It is a Mode for processing service functions with execution of Interpreter routines within the routines for service functions provided if these code routines to be interpreted via the Keyboard can be called, whereby when pressing one on a Franking machine keyboard located the key of this key assigned area from the external storage medium to the Franking machine loaded, authenticated and, if they match is interpreted or otherwise if no code to be interpreted this button is assigned that then with the normal processing of the Button is continued.
  • FIG. 1 is a block diagram of an electronic franking machine shown with increased security according to the invention.
  • the invention is based on a franking machine with a microprocessor, the one contains internal OTP-ROM, which reads out the contained therein Program codes not allowed. It is also security-relevant data stored in the internal OTP-ROM.
  • OTP-ROM OTP-ROM
  • Security bits set during the manufacture of the franking machine become.
  • This can be a commercially available OTP processor that one after programming by setting / burning a readout lock put in such a state or this may be a Microprocessor with mask programmable ROM, which according to the Manufacturing process reading the program code no longer allowed or just read out the program code and data in encrypted form allowed.
  • Figure 1 shows a block diagram of the invention Franking machine with a printer module 1 for a fully electronic generated franking image, with at least one of several actuating elements having input means 2, a display unit 3, the Communication with a MODEM 23 manufacturing data center, further input means 21 or scales 22 which via a Input / output control module 4 are coupled to a control device 6 and with non-volatile memories 5a, 5b and 9, 10 and 11 for data or programs which the variable or the Include constant parts of the franking image.
  • a character memory 9 supplies the necessary print data for the variable Parts of the franking image to a volatile memory 7.
  • the Control device 6 has a microprocessor ⁇ P which is connected to the Input / output control module 4, with the character memory 9, with the volatile working memory 7 and with non-volatile working memories 5a, 5b, which comprise a cost center memory, with a Program memory 11, with the engine of a transport or Feed device optionally with strip release 12, one Encoder (encoder disk) 13 and with a clock / date module 8 in Connection is established.
  • the individual memories can be divided into several physically separate or in a manner not shown in a few Building blocks can be realized together.
  • the memory block which includes the non-volatile working memory 5b be an EEPROM, for example, by at least one additional one Measure, for example sticking to the circuit board, sealing or potting with epoxy resin, is secured against removal.
  • FIG. 2 is a detail of the block diagram of the electronic Franking machine for a variant with OTP in the control device shown.
  • Sensors and actuators such as those in FIG. 1 shown encoder 13 and motor 12 either directly or via I / O ports connected to the OTP.
  • a preferred variant of a microprocessor is an 8051 processor with 16kByte on-chip EPROM (Philips 87C51FB)
  • OTP type One Time Programmable
  • the internal one OTP-RAM has a memory area of 256 bytes.
  • the invention further assumes that security-relevant data and Program parts that are stored in the internal OTP-ROM, one Include interpreters.
  • the interpreter is a special routine that is stored in the internal OTP-ROM is stored and by a via the external EPROM socket from external data structure is activated with the in the internal OTP-ROM stored operating program parts cooperates to data to interpret.
  • one access key each gives access to the corresponding special mode allows the aforementioned Data structure includes information processed by the interpreter and that the OTP-internal CPU executes operations that are exclusively in the code area of the operating program in the internal OTP-ROM are located.
  • the interpreter was integrated and processed in the operating software Defined data structures of the external EPROM at the beginning and end of dealer mode. Thus, according to the invention targeted modification of memory cells of the machine. Consequently can be updated by updating the external service EPROM Operations are performed without the operating software itself change and without taking over program control Allow branching to the external code area.
  • step 35 executed in dealer mode is also one Processing interpreter routines (steps 3717, 3727, 3737).
  • interpreter routines within the routines for dealer functions can be interpreted code routines to be interpreted using the keys a, b, c the keyboard 2 can be called.
  • the software for the dealer and reset mode inside (that is, the internal EPROM and / or internal OTP-ROM) the machine so that none in these modes Branch to the code area of the external memory, with which the memory cells can be changed.
  • the continue to use external reset and service or dealer EPROMs each contain a 64-bit key that only contains the Allows access to the corresponding modes.
  • the CPU only leads still operations that are in the code area of the machine software are also available through a cyclic MAC check Manipulation is protected. To perform the functions of the reset mode, which are in every machine, not for manipulation the functionality of this operating mode became such limited that no increase in monetary amounts or a change the teleporto parameter is enabled.
  • the franking machine is converted into one by an external storage medium special operating state, in which the data state of Memory cells can be changed.
  • Data respectively Program code are from an external storage medium that is sent to the Franking machine is connected by the machine's internal Microprocessor transferred to a memory of the franking machine.
  • the Data / program area contains a MAC that authenticates the area. The validation is checked by the microprocessor Machine made on the copy. Are the data / program code plausible, they are either used directly by the microprocessor Program code processed, or by an interpreter software that the Microprocessor controls, interprets. Not authenticated Data / program areas are no longer processed. The Processing the external information supplied will change used by internal memory cells. Because the external Data / program areas not processed directly by the processor , but always based on the internal copy, the CPU not controlled by external, manipulated program areas become.
  • FIG. 3 shows the structure of a data record which is from Interpreter can be processed.
  • the information provided by the interpreter can be processed is formed by a series of commands which basically consists of a data set with three components consist.
  • a first component OPERATION is characterized by the operation to be executed.
  • a second component TYPE identifies the type of value, which is in a third Component VALUE has been specified.
  • the TYPE determines how the value of the Program line or the stack or the addressed Memory area should be typed. Will not be for the instruction Type specification is required, the type must be specified as T_None.
  • n lines There is interpretable information contained in the service EPROM from n lines.
  • the lines of the program are ascending from 0 numbered and can therefore be used for the execution of Jump instructions can be addressed. Every program line has aforementioned structure: OPERATION; TYPE; VALUE. Another one Variations are also allowed for unary operators (no TYPE, no VALUE).
  • the commands refer to a 12-level stack and allow, for example, the reading of memory cells that Execution of logical and arithmetic operations on the stack and the storage of stack entries in memory cells of the Machine. It can code, and all data storage cells Machine can be addressed. To control the program flow a logical comparison operation is available during the interpretation the associated, conditional and unconditional jump commands for Available.
  • the flow chart shown in Figure 4 shows the schematic Structure and data flow of the interpreter.
  • the interpretable Data structure in the external EPROM must, of course, be replaced by appropriate Measures are protected against possible manipulation, as by the interpreter all data storage areas of the machine are accessible and manipulable. Are in the service EPROM two interpretable memory areas. You will, in relation to the Time of their interpretation, as a prologue (block 91) and epilogue (block 93) designated. Each area is identified by a MAC checksum (block 90 and 92) secured.
  • the interpreter creates a copy of the structure and the MACs (steps 31 and 38) in the internal RAM of the machine and leads then a plausibility check on the copy (steps 33 and 40) by. Working on an internal copy prevents this external manipulation of the program during its interpretation.
  • prologue In the aforementioned work, those contained in the prologue become too interpreting code words interpreted gradually until the end has been reached (or an error has occurred). Basically differentiate prologue and epilogue only by the time they be carried out. In the prologue, for example, data can be saved before the start of the machine-internal dealer routine are saved and this in the epilogue Data will then be restored again.
  • FIG. 5 shows the logical embedding of the interpreter into the internal service or dealer functionality.
  • the structure in the service EPROM is formed by a table in which each line from the components operation, data type of the value or the operation as well as the value.
  • each line can be a fourth component for description of the command.
  • the interpreter lines up the table processed. The order of processing can be followed Jump operations can be influenced.
  • step 31 the prologue is copied into the internal data area of the internal OTP-RAM.
  • a MAC checksum is in step 32 by DES encryption of the CRC checksum formed the prolog code area.
  • the prolog code area is formed and stored in the EPROM.
  • External EPROMs are compared in step 33 with those in the internal one OTP RAM stored volatile MAC's with that in the external service EPROM non-volatile stored MAC. If there is a mismatch both MACs are branched to step 37.
  • step 34 branches to initialize the interpreter.
  • step 35 is entered from the internal data area of the internal OTP-ROM Command read out and processed.
  • step 36 it is checked whether a An error has occurred or the end of command execution has been reached is. In the event of an error or at the end of the command execution, Step 37 branches. Otherwise, the process branches back to step 35.
  • the command pointer points to the first one to be processed Code word.
  • the code words become one after the other Processor register loaded. Approved code words are then processed by executing a special routine for this. To the instruction pointer is incremented for each code word.
  • a command also needs Data (e.g. the destination of a branch after a comparison or a Address), they are also loaded and the command pointer elevated. Certain code words to be interpreted are used for Branching of the program; then the command pointer to one set another place and processing continues at this point. If an error occurs or the end code is recognized, the Processing ended.
  • step 38 by which Process epilogue accordingly.
  • step 38 is done in copying the Epilogs in the internal data area of the internal OTP-RAM.
  • a MAC checksum is in step 39 by DES encryption of the CRC checksum formed over the epilog code area.
  • MAC checksum formed over the Epilog code area and in the EPROM saved.
  • step 40 To authenticate the data in the Epilog code area of the used external EPROMs in step 40, a comparison of the im internal OTP-RAM volatile stored MAC's with that in the external Service EPROM non-volatile stored MAC. If there is a mismatch both MACs are branched to step 44.
  • step 41 branches to initialize the interpreter.
  • step 42 is entered from the internal data area of the internal OTP-ROM Command read out and processed.
  • step 43 it is checked whether a An error has occurred or the end of command execution has been reached is. In the event of an error or at the end of the command execution, Step 44 branches. Otherwise, the process branches back to step 42. in the Step 44 ends the process.
  • the interpreter has a limited stack (set depth: 12 Entries). On the stack, the values are structured as a long value structure (32 bit) and data type.
  • the franking machine can store data as a number or alphanumeric characters are entered, which are displayed in the display unit 3, there are specific additional ones Entry steps to delete the machine number respectively to re-enter or change.
  • the routine for manual Enter the postage call number which is in the internal operating software machine is found to be faulty in the field by moving to Example incorrectly overwrites the machine's serial number. Since this function is located in the internal EPROM of the machine, they can only be corrected by updating the operating software, what that Opening the machine and changing the internal EPROM as well possibly the OTP processor means. Aside from the hassle the dealer is also not allowed to do these operations.
  • the integrated interpreter now offers the following options:
  • the machine developer sends an update of the service EPROM to the dealers. It contains a prologue that copies the memory content of the serial number into a free, temporary memory of the machine.
  • the dealer function for changing the postage call number continues to destroy the serial number, but this can now be restored from the copy of the prologue by means of an appropriate epilogue, which is called up when the dealer functions are ended.
  • prologue and epilogue data structures will used according to the invention for processors with strict separation of Program and data storage.

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Development Economics (AREA)
  • Finance (AREA)
  • Strategic Management (AREA)
  • Theoretical Computer Science (AREA)
  • General Business, Economics & Management (AREA)
  • Economics (AREA)
  • General Engineering & Computer Science (AREA)
  • Game Theory and Decision Science (AREA)
  • Marketing (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Computer Hardware Design (AREA)
  • Devices For Checking Fares Or Tickets At Control Points (AREA)
  • Storage Device Security (AREA)
  • Test And Diagnosis Of Digital Computers (AREA)

Claims (8)

  1. Procédé destiné à la modification des données chargées dans des cellules de mémoire d'une machine à affranchir électronique, comportant un bus et un microprocesseur dans une unité de commande de la machine à affranchir pour l'exécution d'étapes pour une routine qui est commandée par un médium de mémoire externe, comportant l'appel d'une routine de contrôle qui se déroule dans une zone interne sûre d'une machine à affranchir électronique, pour constater la validité de données se basant sur un procédé d'authentification,
    caractérisé par
    a1) la prévision d'un EPROM spécial qui présente une clé pour l'autorisation d'accès et est fichée dans un socle EPROM correspondant, des circuits d'excitation spéciaux, qui sont montés entre le bus et le socle EPROM, empêchant la lecture de l'extérieur de données internes à la machine à affranchir et une structure de données étant appliquée de l'extérieur, avec l'EPROM spécial via le socle EPROM, structure qui contribue, sous l'effet d'un programme correspondant mémorisé dans la machine à affranchir ou d'une routine d'interprétateur interne, à la modification de l'état de la machine à affranchir,
    a2) l'entrée dans un mode spécial après un contrôle d'une autorisation d'accès de la machine à affranchir électronique au moyen d'une clé d'accès mémorisé dans le module de mémoire de lecture seule externe enfiché programmé en conséquence pour entrer dans le mode spécial qui permet une modification des données chargées dans des cellules de mémoire de la machine à affranchir, le module de mémoire de lecture seule enfichable programmé en conséquence contenant un programme à interpréter,
    a3) le chargement du programme à interpréter du module de mémoire de lecture seule externe enfiché dans la machine à affranchir, pour la commande d'une routine dans la machine à affranchir électronique,
    b) l'appel d'une routine de contrôle qui se déroule dans une zone interne sûre d'une machine à affranchir électronique, pour constater la validité du programme chargé à interpréter qui contient des instructions et/ou données dans une place de mémoire prédéfinie, la constatation de la validité se basant sur un procédé d'authentification et
    c) la modification de données dans la machine à affranchir en cas de validité du programme chargé à interpréter vérifié au moyen du procédé d'authentification, après une étape pour l'initialisation d'une routine d'interpréteur, les étapes d'une routine d'interpréteur démarrant afin de modifier les données dans la machine à affranchir, l'interprétateur étant activé comme une routine spéciale, qui est appliquée dans la mémoire de programme interne à la machine à affranchir, par une structure de données mémorisée de l'extérieur via le socle EPROM externe et copiée dans la machine à affranchir, et coopérant avec les parties de programme d'exploitation mémorisées dans la mémoire de programme interne à la machine à affranchir pour interpréter des données, en exécutant sur la copie un examen de plausibilité, une clé d'accès permettant respectivement l'accès au mode spécial correspondant et la structure de données susnommée comprenant des informations qui sont traitées par l'interprétateur et le processus susnommé réalisant des opérations qui se trouvent exclusivement dans la zone de codification du programme d'exploitation dans la mémoire de programme interne à la machine à affranchir, ou abandon de la routine de contrôle de la machine à affranchir si le programme chargé à interpréter est non valable, et des étapes se déroulant pour empêcher une autre exécution du programme pour la manipulation ou une ramification de programme conduisant de la machine à affranchir électrique vers l'extérieur.
  2. Procédé selon la revendication 1, caractérisé par les étapes se déroulant après l'entrée dans le mode spécial et le chargement du programme à interpréter:
    formation d'une première somme de contrôle MAC dans le processeur de la machine à affranchir électronique via un premier contenu (91) chargé à interpréter des contenus de la mémoire externe à laquelle est affecté un premier MAC,
    comparaison de la somme de contrôle MAC formée de la manière susnommée dans le processeur susnommé avec la valeur du premier MAC mémorisée dans le moyen de mémoire externe,
    réalisation d'une routine de traitement pour le traitement du premier contenu de mémoire (91) transmis dans le processeur susnommé après une interprétation du programme chargé à interpréter ou abandon de la routine de contrôle de la machine à affranchir si les données sont non valables et des étapes pour empêcher une autre exécution de programme pour la manipulation ou ramification de programme conduisant du processeur susnommé vers l'extérieur,
    réalisation de routines de commerçant internes pour modifier des données dans des cellules de mémoire de la machine à affranchir,
    chargement d'un autre programme à interpréter d'un module de mémoire de lecture seule externe enfiché dans la machine à affranchir,
    formation d'une deuxième somme de contrôle MAC dans le processeur susnommé via un deuxième contenu chargé à interpréter des contenus de la mémoire externe à laquelle est affecté un deuxième MAC,
    comparaison de la somme de contrôle MAC formée de la manière susnommée dans le processeur susnommé avec la valeur du deuxième MAC mémorisée dans le moyen de mémoire externe,
    réalisation d'une routine de traitement pour le traitement du premier contenu de mémoire transmis dans le processeur en cas d'égalité des MAC susnommés après une interprétation du programme chargé à interpréter et achèvement de la routine de traitement EPILOG ou empêchement de la réalisation de la routine de contrôle si une erreur est constatée.
  3. Procédé selon les revendications 1 à 2, caractérisé en ce que l'information qui peut être traitée par l'interprétateur est formée par une série d'ordres qui se composent d'un enregistrement de données avec trois composantes, une première composante caractérisant l'OPERATION, l'opération à exécuter par l'ordre respectif, une deuxième composante caractérisant le TYPE, le type de la valeur qui a été indiquée dans la troisième composante VALEUR.
  4. Procédé selon les revendications 1 à 3, caractérisé en ce que, après le démarrage (39) déclenché par l'actionnement de la touche préaffectée et après l'entrée dans le mode spécial, qui a lieu en raison d'un contrôle d'une autorisation d'accès, dans une étape (31 resp. 38) une copie du prologue respectivement épilogue a lieu dans la zone de données interne de l'OTP-RAM interne, une somme de contrôle MAC est formée, dans une autre étape (32 resp. 39), par codification d'une somme de contrôle via la zone de codification PROLOGUE ou EPILOGUE et, dans l'étape suivante (33 resp. 40), une comparaison de MAC est réalisée avec la somme de contrôle formée lors de la fabrication ou programmation de l'EPROM spécial et mémorisée dans l'EPROM spécial via la zone de codification du PROLOGUE ou EPILOGUE et en ce que, après des étapes (34, 35 resp. 41, 42) pour la réalisation d'une routine d'interprétateur incluant un contrôle de plausibilité, une autre étape de vérification (36 resp. 43) est prévue qui constate les cas erronés survenant lors de l'exécution d'un programme ou les cas qui conduisent à l'achèvement de l'opération d'interprétation, ou renvoie à l'autre étape de vérification (36 resp. 43) afin d'exécuter d'autres ordres.
  5. Procédé selon les revendications 1 à 3, caractérisé par les étapes
    prévision de plusieurs zones dans le médium de mémoire externe qui contiennent des codes à interpréter, les différentes zones étant sécurisées au moyen du MAC,
    prévision d'un mode pour l'exécution des fonctions de service pour la réalisation de routines de commerçant internes pour modifier des données dans des cellules de mémoire de la machine à affranchir,
    réalisation de routines d'interprétateur à l'intérieur des routines pour des fonctions de service si celles-ci sont appelées via le clavier pour des routines de code à interpréter, lors de l'actionnement d'une touche se trouvant sur un clavier de la machine à affranchir, la zone affectée à cette touche provenant du médium de mémoire externe étant chargée dans la machine à affranchir, authentifiée et, en cas de concordance, interprétée ou dans le cas contraire, si aucun code à interpréter n'est affecté à cette touche, que l'on poursuive avec le traitement normal de la pression de touche.
  6. Procédé selon la revendication 5, caractérisé par les étapes
    transmission d'une valeur MAC prédéfinie mémorisée en externe dans l'OTP-RAM pour la mémorisation volatile et une formation d'une première somme de contrôle MAC dans le processeur OTP via un premier des contenus de la mémoire à laquelle est affecté un premier MAC,
    entrée dans le mode pour l'exécution de fonctions de service et réalisation de routines pour des fonctions de service avec des routines d'interprétateur ainsi qu'achèvement du module pour l'exécution de fonctions de service,
    transmission d'une valeur MAC prédéfinie mémorisée en externe dans l'OTP-RAM pour la mémorisation volatile et une formation d'une deuxième somme MAC dans le processeur OTP via un deuxième des contenus de la mémoire à laquelle est affecté un deuxième MAC.
  7. Procédé selon les revendications 1 à 6, caractérisé en ce que la touche préaffectée est protégée au moyen d'un clapet postal qui est ouvert pour actionner la touche préaffectée pour entrer dans le mode spécial.
  8. Procédé selon les revendications 1 à 7, caractérisé en ce que l'interprétateur en tant que routine spéciale qui est mémorisée dans l'OTP-ROM interne, est activé par une structure de données appliquée de l'extérieur via le socle EPROM externe, et coopère avec les parties de programme d'exploitation mémorisées dans l'OTP-ROM interne pour interpréter des données, une clé d'accès permettant respectivement l'accès au mode spécial correspondant et la structure de données comprenant des informations qui sont traitées par l'interprétation et la OTP interne à CPU exécutant des opérations qui se trouvent exclusivement dans la zone de codification du programme d'exploitation dans l'OTP-ROM interne.
EP96250187A 1995-09-08 1996-08-30 Procédé pour changer les données chargées dans des cellules de stockage d'une machine d'affranchissement Expired - Lifetime EP0762335B1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE19534528 1995-09-08
DE19534528A DE19534528A1 (de) 1995-09-08 1995-09-08 Verfahren zur Veränderung der in Speicherzellen geladenen Daten einer elektronischen Frankiermaschine

Publications (3)

Publication Number Publication Date
EP0762335A2 EP0762335A2 (fr) 1997-03-12
EP0762335A3 EP0762335A3 (fr) 2000-01-12
EP0762335B1 true EP0762335B1 (fr) 2003-06-04

Family

ID=7772450

Family Applications (1)

Application Number Title Priority Date Filing Date
EP96250187A Expired - Lifetime EP0762335B1 (fr) 1995-09-08 1996-08-30 Procédé pour changer les données chargées dans des cellules de stockage d'une machine d'affranchissement

Country Status (3)

Country Link
US (1) US5734571A (fr)
EP (1) EP0762335B1 (fr)
DE (2) DE19534528A1 (fr)

Families Citing this family (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO1999066422A1 (fr) * 1995-06-07 1999-12-23 Ascom Hasler Mailing Systems, Inc. Technique assurant la securite de la configuration d'un systeme postal d'affranchissement
DE19928057B4 (de) * 1999-06-15 2005-11-10 Francotyp-Postalia Ag & Co. Kg Sicherheitsmodul und Verfahren zur Sicherung der Postregister vor Manipulation
DE19913067A1 (de) 1999-03-17 2000-09-21 Francotyp Postalia Gmbh Verfahren zur automatischen Installation von Frankiereinrichtungen und Anordnung zur Durchführung des Verfahrens
DE10036623A1 (de) * 2000-07-27 2002-02-07 Francotyp Postalia Gmbh Postmaschine und Verfahren zu deren Initialisierung
DE10037177A1 (de) * 2000-07-31 2002-02-14 Giesecke & Devrient Gmbh Banknotenbearbeitungsmaschine und Verfahren zum Betreiben der Banknotenbearbeitungsmaschine
US7994934B2 (en) 2004-10-05 2011-08-09 Electro Industries/Gauge Tech Meter having a communication interface for receiving and interfacing with a communication device
US7305310B2 (en) * 2004-10-18 2007-12-04 Electro Industries/Gauge Tech. System and method for compensating for potential and current transformers in energy meters
US9080894B2 (en) 2004-10-20 2015-07-14 Electro Industries/Gauge Tech Intelligent electronic device for receiving and sending data at high speeds over a network
US7508190B2 (en) * 2004-10-20 2009-03-24 Electro Industries/Gauge Tech. Test pulses for enabling revenue testable panel meters
US7304586B2 (en) 2004-10-20 2007-12-04 Electro Industries / Gauge Tech On-line web accessed energy meter
US7747733B2 (en) 2004-10-25 2010-06-29 Electro Industries/Gauge Tech Power meter having multiple ethernet ports
US7388189B2 (en) * 2004-10-27 2008-06-17 Electro Industries/Gauge Tech System and method for connecting electrical devices using fiber optic serial communication
US7184904B2 (en) * 2005-01-20 2007-02-27 Electro Industries/Gaugetech System and method for providing universal additional functionality for power meters
US8581169B2 (en) * 2005-01-24 2013-11-12 Electro Industries/Gauge Tech System and method for data transmission between an intelligent electronic device and a remote device
US8190381B2 (en) 2005-01-27 2012-05-29 Electro Industries/Gauge Tech Intelligent electronic device with enhanced power quality monitoring and communications capabilities
US8160824B2 (en) 2005-01-27 2012-04-17 Electro Industries/Gauge Tech Intelligent electronic device with enhanced power quality monitoring and communication capabilities
US8620608B2 (en) 2005-01-27 2013-12-31 Electro Industries/Gauge Tech Intelligent electronic device and method thereof
US7996171B2 (en) 2005-01-27 2011-08-09 Electro Industries/Gauge Tech Intelligent electronic device with broad-range high accuracy
US7920976B2 (en) 2007-03-27 2011-04-05 Electro Industries / Gauge Tech. Averaging in an intelligent electronic device
US20130275066A1 (en) 2007-04-03 2013-10-17 Electro Industries/Gaugetech Digital power metering system
US9989618B2 (en) 2007-04-03 2018-06-05 Electro Industries/Gaugetech Intelligent electronic device with constant calibration capabilities for high accuracy measurements
US10845399B2 (en) 2007-04-03 2020-11-24 Electro Industries/Gaugetech System and method for performing data transfers in an intelligent electronic device
US12061218B2 (en) 2008-03-13 2024-08-13 Ei Electronics Llc System and method for multi-rate concurrent waveform capture and storage for power quality metering
US11516899B2 (en) 2015-05-27 2022-11-29 Electro Industries/Gauge Tech Devices, systems and methods for electrical utility submetering
US10585125B2 (en) 2015-05-27 2020-03-10 Electro Industries/ Gaugetech Devices, systems and methods for data transmission over a communication media using modular connectors
DE102017011915A1 (de) * 2017-12-21 2019-06-27 Giesecke+Devrient Mobile Security Gmbh Verfahren zur Sicherheitsverbesserung eines in einem Terminal laufenden Softwarecodes

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB2144081B (en) * 1983-07-23 1987-10-28 Pa Consulting Services Postal franking machines
CA1233252A (fr) * 1983-09-12 1988-02-23 Michael E. Field Methode et appareil de mise a jour de donnees relatives a des parametres
GB2173738B (en) * 1985-04-19 1989-07-12 Roneo Alcatel Ltd Secure transport of information between electronic stations
US4982430A (en) * 1985-04-24 1991-01-01 General Instrument Corporation Bootstrap channel security arrangement for communication network
US4812965A (en) * 1985-08-06 1989-03-14 Pitney Bowes Inc. Remote postage meter insepction system
US4785417A (en) * 1986-04-28 1988-11-15 Pitney Bowes Inc. Electronic postage meter having an out of sequence checking arrangement
US4712239A (en) * 1986-06-16 1987-12-08 General Instrument Corporation Security arrangement for downloadable cable television converters
WO1988001818A1 (fr) * 1986-09-02 1988-03-10 Wright Christopher B Systeme de transaction automatise utilisant des cartes a microprocesseur
US5270931A (en) * 1989-02-23 1993-12-14 The Boeing Company Software controlled aircraft component configuration system
US5132716A (en) * 1990-04-04 1992-07-21 Eastman Kodak Company System for updating software in automatic film processor
DE69024638T2 (de) * 1990-05-21 1996-05-15 Hewlett Packard Gmbh Aktivierungsschaltung
US5311582A (en) * 1991-08-06 1994-05-10 International Teleservice Corporation Integrated cocot and regulated paystation telephone system
US5349685A (en) * 1992-05-05 1994-09-20 The United States Of America As Represented By The Secretary Of The Navy Multipurpose bus interface utilizing a digital signal processor
US5307505A (en) * 1992-05-05 1994-04-26 The United States Of America As Represented By The Secretary Of The Navy Rapid reprogramming terminal
IL103062A (en) * 1992-09-04 1996-08-04 Algorithmic Res Ltd Data processor security system
US5448641A (en) * 1993-10-08 1995-09-05 Pitney Bowes Inc. Postal rating system with verifiable integrity
DE4344476A1 (de) * 1993-12-21 1995-06-22 Francotyp Postalia Gmbh Verfahren zur Verbesserung der Sicherheit von Frankiermaschinen

Also Published As

Publication number Publication date
EP0762335A2 (fr) 1997-03-12
DE59610490D1 (de) 2003-07-10
US5734571A (en) 1998-03-31
EP0762335A3 (fr) 2000-01-12
DE19534528A1 (de) 1997-03-13

Similar Documents

Publication Publication Date Title
EP0762335B1 (fr) Procédé pour changer les données chargées dans des cellules de stockage d'une machine d'affranchissement
DE3613007B4 (de) System zur Ermittlung von nicht-abgerechneten Drucken
EP0762337A2 (fr) Procédé et dispositif pour augmenter la protection contre la manipulation de données critiques
DE3729342A1 (de) Sicherheitsdrucker fuer ein wertdrucksystem
DE10137505B4 (de) Anordnung und Verfahren zum Ändern der Funktionalität eines Sicherheitsmoduls
DE69527258T2 (de) System zum Abrechnen von Postgebühren mit Mitteln zum Übertragen ASCII-kodierter variabler Informationen zum Steuern eines externen Druckers
DE69510833T2 (de) Frankiermaschine mit einem gesicherten und einem ungesicherten Modul
EP0155399A2 (fr) Circuit de protection contre l'exécution non-autorisée d'un programme
DE69729915T2 (de) Verfahren und Vorrichtung zur ferngesteuerten Änderung von Sicherheitsmerkmalen einer Frankiermaschine
EP0930586A2 (fr) Dispositif et méthode pour l'échange de données entre une machine d'affranchissement et des cartes à puce
DE19757653C2 (de) Verfahren und postalisches Gerät mit einer Chipkarten-Schreib/Leseeinheit zum Nachladen von Änderungsdaten per Chipkarte
EP1063619B1 (fr) Module de sécurité et procédé pour protection du registre postal contre la manipulation
EP1358571B1 (fr) Dispositif de traitement de donnees
DE3884485T2 (de) Frankiermaschinensystem.
DE3650330T2 (de) Frankiermaschinensystem zur nichtflüchtigen Speicherung von Daten.
DE19534530A1 (de) Verfahren zur Absicherung von Daten und Programmcode einer elektronischen Frankiermaschine
EP1636700A1 (fr) Procede de rechargement d'un logiciel dans le secteur d'amor age d'une memoire morte programmable
EP0969420A2 (fr) Procédé pour sécuriser la transmission de données de service à un terminal et dispositif pour la mise en oeuvre de ce procédé
DE19534529C2 (de) Verfahren zur Erhöhung der Manipulationssicherheit von kritischen Daten
DE102004046018A1 (de) Verfahren und Vorrichtung zum Frankieren von Postsendungen
DE19534527C2 (de) Verfahren zur Erhöhung der Manipulationssicherheit von kritischen Daten
EP1120751A1 (fr) Machine à affranchir avec l'accès sécurisé
EP0717379A2 (fr) Procédé pour l'amélioration de la sécurité des machines à timbrer pendant le transfert du crédit
DE102004021088A1 (de) Verfahren zum Schützen von Daten eines Datenträgers gegen DFA-Angriffe
DE4302097A1 (de) Anordnung zur Erzeugung eines jeweils einer Kostenstelle zugeordneten Frankierbildes

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A2

Designated state(s): CH DE FR GB IT LI

PUAL Search report despatched

Free format text: ORIGINAL CODE: 0009013

AK Designated contracting states

Kind code of ref document: A3

Designated state(s): CH DE FR GB IT LI

17P Request for examination filed

Effective date: 20000203

17Q First examination report despatched

Effective date: 20020408

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: FRANCOTYP-POSTALIA AG & CO. KG

GRAH Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOS IGRA

GRAH Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOS IGRA

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Designated state(s): CH DE FR GB IT LI

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

Free format text: NOT ENGLISH

REG Reference to a national code

Ref country code: CH

Ref legal event code: NV

Representative=s name: RITSCHER & PARTNER AG PATENTANWAELTE

Ref country code: CH

Ref legal event code: EP

REF Corresponds to:

Ref document number: 59610490

Country of ref document: DE

Date of ref document: 20030710

Kind code of ref document: P

GBT Gb: translation of ep patent filed (gb section 77(6)(a)/1977)

Effective date: 20031008

ET Fr: translation filed
PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20040305

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20090827

Year of fee payment: 14

Ref country code: DE

Payment date: 20090604

Year of fee payment: 14

Ref country code: CH

Payment date: 20090825

Year of fee payment: 14

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: IT

Payment date: 20090821

Year of fee payment: 14

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20100830

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100831

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100831

REG Reference to a national code

Ref country code: FR

Ref legal event code: ST

Effective date: 20110502

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100830

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 59610490

Country of ref document: DE

Effective date: 20110301

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20110301

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100831

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20100830

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20090914

Year of fee payment: 14